Windows Server 2003 is locked down quite heavily by default; rather than leaving the surface very wide open for administrators to find all the holes and patch them, this version of Windows makes the administrator consciously decide to open certain services (e.g. IIS).